Enterprise Microsoft Q&A: Hello for Buttprint

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Enterprise Microsoft Q&A: Hello for Buttprint

«‹›260 »

Dans Macabre: Apr 24, 2004

devmd01 posted:

There's only one way to find out

Trip report: it was safe to do during business hours :shobon:

%99.99 snipe level agreement

# ? Jul 13, 2017 00:17

Adbot: ADBOT LOVES YOU

# ? Apr 24, 2024 07:05

devmd01: Mar 7, 2006; Elektronik
Supersonik

I just trimmed 7 domain controllers down to 4, switched from FRS to DFSR for sysvol, and I'll be replacing the remaining 4 with server 2016 DCs. One of the other engineers is amazed at how fast objects replicate now and I'm like "no poo poo, you had way more DCs than needed."

Can't bump to 2016 functional level until our archive exchange 2010 server goes away next year, ugh.

Question about delegated rights: a predecessor granted domain users read delegation to the primary OU where users were located. I'm trying to think of why this could be a bad idea and I'm coming up short. I discovered it after we migrated users to a new OU and it broke some applications, because the service accounts needed read delegation to work. I'd rather go least privileged and put the appropriate service accounts in a security group that has read delegation to the new OU, instead of granting to domain users. Any thoughts?

# ? Jul 18, 2017 12:39

GreenNight: Feb 19, 2006; Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

Good timing on 2016. We upgraded to 2016 DC's and all our Windows 7 workstations would have the explorer.exe crash randomly. Hundreds of machines. They finally patched that last month.

# ? Jul 18, 2017 13:10

devmd01: Mar 7, 2006; Elektronik
Supersonik

That's....disturbing. What was the fix, the monthly cumulative for win7? I'll want to validate deployment of it with desktop before I go any further.

# ? Jul 18, 2017 13:16

AreWeDrunkYet: Jul 8, 2006

devmd01 posted:

Question about delegated rights: a predecessor granted domain users read delegation to the primary OU where users were located. I'm trying to think of why this could be a bad idea and I'm coming up short. I discovered it after we migrated users to a new OU and it broke some applications, because the service accounts needed read delegation to work. I'd rather go least privileged and put the appropriate service accounts in a security group that has read delegation to the new OU, instead of granting to domain users. Any thoughts?

There's not a lot of downside to read rights across the board, with the exception that now anyone can spin up a job that could peg your DCs.

# ? Jul 18, 2017 13:58

GreenNight: Feb 19, 2006; Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

devmd01 posted:

That's....disturbing. What was the fix, the monthly cumulative for win7? I'll want to validate deployment of it with desktop before I go any further.

It was a nightmare. IE would crash upon load, and opening explorer.exe would give you permissions errors, then that too would crash It wouldn't happen all the time, just randomly and then go away randomly. You couldn't force it to happen. We had an incident with Microsoft open since April and it was finally fixed at the beginning of July. The workaround was to use Chrome or Firefox and open your explorer window via My Computer.

Yeah the cumulative update seemed to fix it. At least no users have reported the issue since we pushed that out. And they know to tell me if it happens again.

The only good thing is that it pushed our Windows 10 deployment, so all our laptop users got migrated to Windows 10 off Windows 7.

# ? Jul 18, 2017 14:23

Briantist: Dec 5, 2003; The Professor does not approve of your post.; Lipstick Apathy

Beware that there are DNS bugs in 2016. Some are related to DNS Policies, but there's a bug regarding delegated and stub zones and CNAME resolution; a bug which does not exist in earlier versions. Microsoft is aware of the problem, but I have no idea when a fix might be available.

# ? Jul 18, 2017 18:59

Wrath of the Bitch King: May 11, 2005; Research confirms that black is a color like silver is a color, and that beyond black is clarity.

devmd01 posted:

switched from FRS to DFSR for sysvol

How smooth was the process? Leadership has cold feet on doing it, but from what I've seen it's pretty painless despite taking a couple of weeks to complete.

Mind elaborating on your experience a little?

# ? Jul 18, 2017 20:58

devmd01: Mar 7, 2006; Elektronik
Supersonik

I've done it for three domains at two jobs so far during the middle of the day with no impact. The doc is pretty comprehensive on the migration steps, it really is as easy as going down each command. Just make sure that you have every domain controller open and understand how your replication links are set up, so you can speed things up with a repadmin /syncall /AeV instead of having to wait for replication to occur each step.

E: takes about an hour or two in a domain with 4-6 DCs and multiple sites.

devmd01 fucked around with this message at 21:43 on Jul 18, 2017

# ? Jul 18, 2017 21:39

mayodreams: Jul 4, 2003; Hello darkness,
my old friend

Briantist posted:

Beware that there are DNS bugs in 2016. Some are related to DNS Policies, but there's a bug regarding delegated and stub zones and CNAME resolution; a bug which does not exist in earlier versions. Microsoft is aware of the problem, but I have no idea when a fix might be available.

Do you have any links for those bugs? I am seeing some DNS fuckery in 2016 and I wonder if its correlated.

Also, this is why you don't let your security guys jump onto 2016 for a prod environment 3 months after it ships. :ughh:

# ? Jul 18, 2017 22:30

GreenNight: Feb 19, 2006; Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

We just put ours in Aprilish and we thought that would be enough time :mad:

# ? Jul 18, 2017 22:35

peak debt: Mar 11, 2001; b& :(; Nap Ghost

AreWeDrunkYet posted:

There's not a lot of downside to read rights across the board, with the exception that now anyone can spin up a job that could peg your DCs.

"Authenticated User" already has read rights on all of AD by default, with the exception of very few attributes.

If you are using Bitlocker with the recovery key stored in AD I'd check whether a nonprivileged account can read that particular attribute (msFVE-RecoveryInformation), otherwise this is nothing special.

Edit: After upgrading to Server 2016 DCs, we had some weird explorer.exe crashes for a few users that were resolved by deleting the SID history from an 8 year old domain migration.

peak debt fucked around with this message at 16:17 on Jul 19, 2017

# ? Jul 19, 2017 16:14

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

Bitlocker keys are an attribute of the computer object and it sounds like the delegated permissions to a user object OU so that shouldn't be a problem. If you are doing something in your GAL to hid phone #s of execs or something you might have an issue where you can bypass that with an LDAP query

# ? Jul 19, 2017 19:21

Zero VGS: Aug 16, 2002; ASK ME ABOUT HOW HUMAN LIVES THAT MADE VIDEO GAME CONTROLLERS ARE WORTH MORE; Lipstick Apathy

This still doesn't actually... work, right?

Employees are complaining that it's impossible to collaborate on Sharepoint word/excel docs together in a team of five (locked due to editing when no one is editing, saving in the wrong places etc) and I'm chalking it up Microsoft not having improved anything since the last time I tried to sort this poo poo out 6 years ago.

Any affordable enterprise alternatives or do I have to just hold my nose?

# ? Jul 19, 2017 21:08

Thanks Ants: May 21, 2004; #essereFerrari

Only SharePoint will let you co-author Office documents.

# ? Jul 19, 2017 21:14

thebigcow: Jan 3, 2001; Bully!

Thanks Ants posted:

Only SharePoint will let you co-author Office documents.

Isn't OneDrive for Business just sharepoint?

quote:

With Office 2016 and OneDrive for Business, you can co-edit and share documents right from your Office apps like Word, Excel, PowerPoint and Visio. If you sync your files to your computer, OneDrive and Office work together to sync documents and let you work with other people on shared documents at the same time.

But apparently not

# ? Jul 19, 2017 21:56

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

I use OneDrive business for work collab and the sync stuff is definitely Sharepoint on the backend.

# ? Jul 19, 2017 22:00

Thanks Ants: May 21, 2004; #essereFerrari

It is SharePoint, yeah. Sorry for making that not too clear.

# ? Jul 19, 2017 22:01

Hippie Hedgehog: Feb 19, 2007; Ever cuddled a hedgehog?

Zero VGS posted:

This still doesn't actually... work, right?

Employees are complaining that it's impossible to collaborate on Sharepoint word/excel docs together in a team of five (locked due to editing when no one is editing, saving in the wrong places etc) and I'm chalking it up Microsoft not having improved anything since the last time I tried to sort this poo poo out 6 years ago.

Any affordable enterprise alternatives or do I have to just hold my nose?

Simultaneous editing of Excel files has been working quite well for me. But word, no, merging text files is still a task people struggle with no matter how nice tools you give them. The concept of merging two edits into a third version is just too much for non-programmers to wrap their heads around.

# ? Jul 19, 2017 22:33

Methanar: Sep 26, 2013; by the sex ghost

Zero VGS posted:

This still doesn't actually... work, right?

Employees are complaining that it's impossible to collaborate on Sharepoint word/excel docs together in a team of five (locked due to editing when no one is editing, saving in the wrong places etc) and I'm chalking it up Microsoft not having improved anything since the last time I tried to sort this poo poo out 6 years ago.

Any affordable enterprise alternatives or do I have to just hold my nose?

Force everyone to use git.

# ? Jul 19, 2017 22:35

Thanks Ants: May 21, 2004; #essereFerrari

Google Docs seems fine :smuggo:

# ? Jul 19, 2017 22:38

peak debt: Mar 11, 2001; b& :(; Nap Ghost

There's this new product called Google Wave that will allow you to seamlessly co-edit documents. The demo video looks really cool I can't wait for the release.

# ? Jul 20, 2017 15:55

nexxai: Jul 17, 2002; quack quack bjork; Fun Shoe

peak debt posted:

There's this new product called Google Wave that will allow you to seamlessly co-edit documents. The demo video looks really cool I can't wait for the release.

I'm really hoping this is super-thick sarcasm

https://en.wikipedia.org/wiki/Apache_Wave - released in 2009.

# ? Jul 20, 2017 20:07

Dans Macabre: Apr 24, 2004

Thanks Ants posted:

Google Docs seems fine

haha

# ? Jul 20, 2017 21:21

Briantist: Dec 5, 2003; The Professor does not approve of your post.; Lipstick Apathy

mayodreams posted:

Do you have any links for those bugs? I am seeing some DNS fuckery in 2016 and I wonder if its correlated.

Also, this is why you don't let your security guys jump onto 2016 for a prod environment 3 months after it ships.

Delegated/Stub Zone Issue (and another), and for an in-depth diagnosis.

DNS Policies Issue

# ? Jul 21, 2017 17:15

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

We have a weird server setup, where we have an IIS frontend, which talks to a couple of servers with standalone SQL Server Reporting Services, which then talk to a SQL database backend. Our test/QA and dev environments use an IIS frontend that talks to a SQL database server with SSRS built in. The DBA/webdevs "recently" discovered an issue in production where some reports will throwing 401 errors after the query has run for ~60 seconds. This doesn't happen in test/QA. I say "recently" because we did install a secondary IIS frontend and put haproxy in front to load-balance them, but internally we haven't made the DNS changeover to redirect to the VIP, but this 401 timeout issue is getting blamed on the load balancer. Getting the web/DBA team to accurately describe anything is like pulling loving teeth. A few weeks ago the morning after we deployed the loadbalancer to the public, we got an urgent all-hands call that all reports were erroring out, and then going through discovery it was changed to an intermittent issue affecting all reports, and eventually it was determined to be just one singular report that was erroring, because they had configured it wrong.

Anyway. What it looks like the issue might be is that we should be using Kerberos authentication to make the "double-hop" from frontend to reporting server to SQL database. Has anyone else had any experience with this setup? The whole thing seems to be documented pretty thoroughly, so I'm not too concerned, but I'd like to know if anyone has run into a similar issue or can tell me about any traps I might run into. This weekend I'll be telling the reporting services on one of the test/QA boxes to talk to the other test/QA box's database and then rolling out these Kerberos changes.

# ? Jul 21, 2017 21:07

Briantist: Dec 5, 2003; The Professor does not approve of your post.; Lipstick Apathy

anthonypants posted:

We have a weird server setup, where we have an IIS frontend, which talks to a couple of servers with standalone SQL Server Reporting Services, which then talk to a SQL database backend. Our test/QA and dev environments use an IIS frontend that talks to a SQL database server with SSRS built in. The DBA/webdevs "recently" discovered an issue in production where some reports will throwing 401 errors after the query has run for ~60 seconds. This doesn't happen in test/QA. I say "recently" because we did install a secondary IIS frontend and put haproxy in front to load-balance them, but internally we haven't made the DNS changeover to redirect to the VIP, but this 401 timeout issue is getting blamed on the load balancer. Getting the web/DBA team to accurately describe anything is like pulling loving teeth. A few weeks ago the morning after we deployed the loadbalancer to the public, we got an urgent all-hands call that all reports were erroring out, and then going through discovery it was changed to an intermittent issue affecting all reports, and eventually it was determined to be just one singular report that was erroring, because they had configured it wrong.

Anyway. What it looks like the issue might be is that we should be using Kerberos authentication to make the "double-hop" from frontend to reporting server to SQL database. Has anyone else had any experience with this setup? The whole thing seems to be documented pretty thoroughly, so I'm not too concerned, but I'd like to know if anyone has run into a similar issue or can tell me about any traps I might run into. This weekend I'll be telling the reporting services on one of the test/QA boxes to talk to the other test/QA box's database and then rolling out these Kerberos changes.

I don't have experience with this use case directly, but the term double-hop generally describes the problem, not the solution. The solutions are usually kerberos delegation, or an alternative authentication scheme (CredSSP), but they both have their caveats and (critically) security concerns.

I can't really fathom how a double-hop issue would only affect a single report though. It either is a problem or it isn't. It's not something that shows itself intermittently, unless the second hop is triggered intermittently.

# ? Jul 21, 2017 23:04

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Briantist posted:

I don't have experience with this use case directly, but the term double-hop generally describes the problem, not the solution. The solutions are usually kerberos delegation, or an alternative authentication scheme (CredSSP), but they both have their caveats and (critically) security concerns.

I can't really fathom how a double-hop issue would only affect a single report though. It either is a problem or it isn't. It's not something that shows itself intermittently, unless the second hop is triggered intermittently.

After turning HTTP logging on at the reporting server, we're definitely getting constant 401 errors that would seem to indicate the double-hop issue, so this is what we're moving forward with. I also don't know why reports that run longer than 60 seconds get killed, but my best guess is that the reports server does enough caching that it takes 60 seconds worth of calculations before it starts asking the backend for updates, at which point it hits the 401 wall.

# ? Jul 22, 2017 00:06

EssOEss: Oct 23, 2006; 128-bit approved

Re: building Windows setup ISOs with patches already applied.

Took a lot of random patchwork assembling of stuff from different articles but so far this seems to be working out fine:

1. Get suitable .msu format patches from the Microsoft Update Catalog.
1. Extract files from setup ISO.
1. Mount WIM.
1. Add-Package all the .msu files using dism.exe
1. Save changes to WIM
1. Make a new Windows install iso using oscdimg.exe from the Windows ADK.

I have got it fully automated and all I need to do to make new ISOs is to check in an updated list of URLs for the patches to install. This cuts a lot of time off the custom image building, so I am happy. Thanks for all the suggestions!

# ? Jul 24, 2017 13:55

devmd01: Mar 7, 2006; Elektronik
Supersonik

Has anyone rolled out windows management framework 5.1? Did you run into any compatibility issues beyond what is noted in the known incompatibilities, i.e. Exchange 2010?

# ? Jul 25, 2017 13:18

Briantist: Dec 5, 2003; The Professor does not approve of your post.; Lipstick Apathy

devmd01 posted:

Has anyone rolled out windows management framework 5.1? Did you run into any compatibility issues beyond what is noted in the known incompatibilities, i.e. Exchange 2010?

I've installed it on several machines with no issues, but I generally don't touch the kind of software that has those compatibility problems (exchange, sharepoint, skype/lync).

# ? Jul 25, 2017 18:42

Coredump: Dec 1, 2002

Is there any way to get the Linux sub system running on windows 10 ltsb or am I going back to cygwin?

# ? Jul 25, 2017 18:50

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Coredump posted:

Is there any way to get the Linux sub system running on windows 10 ltsb or am I going back to cygwin?

LTSB doesn't even have Microsoft Edge.

# ? Jul 25, 2017 18:57

Coredump: Dec 1, 2002

anthonypants posted:

LTSB doesn't even have Microsoft Edge.

Is Microsoft Edge a required component for Linux?

# ? Jul 25, 2017 19:12

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Coredump posted:

Is Microsoft Edge a required component for Linux?

I'm saying that it doesn't have a lot of Windows 10 features. Bash on Windows 10 just came out of the insider builds this year, didn't it?

# ? Jul 25, 2017 19:20

buffbus: Nov 19, 2012

Looks like it's available in my LTSB 2016 VM

# ? Jul 25, 2017 21:37

milk milk lemonade: Jul 29, 2016

Briantist posted:

Delegated/Stub Zone Issue (and another), and for an in-depth diagnosis.

DNS Policies Issue

What in the name of Christ Microsoft

# ? Jul 26, 2017 04:03

Coredump: Dec 1, 2002

buffbus posted:

Looks like it's available in my LTSB 2016 VM

I got that checked on my machine too, and then entered the command "bash" into an admin command prompt and this is what I got:

code:

C:\Windows\system32>bash
-- Beta feature --
This will install Ubuntu on Windows, distributed by Canonical
and licensed under its terms available here:
[url]https://aka.ms/uowterms[/url]

The app that you are trying to run is not supported on this version of Windows.

Does anyone know of a sneaky way around this? I'm thinking I'm SOL but here's hoping.

# ? Jul 26, 2017 13:53

EssOEss: Oct 23, 2006; 128-bit approved

Yeah the workaround is pretty easy: install non-LTSB Windows.

# ? Jul 26, 2017 15:50

Adbot: ADBOT LOVES YOU

# ? Apr 24, 2024 07:05

peak debt: Mar 11, 2001; b& :(; Nap Ghost

The current LTSB is just extremely limited, it's pretty much the pre-release beta.
I wouldn't go as far as Microsoft and say it's only good for POS and ATM devices. But you definitely cannot expect modern newfangled concepts like Linux on Windows.

# ? Jul 31, 2017 11:54

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Enterprise Microsoft Q&A: Hello for Buttprint

«‹›260 »